Re: [hybi] More on Payload Masking

[Brodie Thiesfield <[e-mail]>]

On Fri, Nov 12, 2010 at 2:34 AM, Scott Ferguson <[e-mail]> wrote:
> Repeating Willy's point for emphasis: a keepalive server/proxy must parse
> all framing content for keepalives to work, including http headers,
> chunking, etc. for both the request and the response. It cannot skip invalid
> bytes and continue the keepalive. Because there's no way to recover from the
> framing errors, the server/proxy needs to close the connection after the
> error if the HTTP framing breaks.

Since there is concern that a server may continuing to process the
HTTP stream after an Upgrade, then just include data in the stream
specifically for that possibility. Immediately following the CRLF of
the upgrade request, require the client to send a fixed string that is
basically valid HTTP and requests connection close.

WEBSOCKET / HTTP/1.1
...
CRLF

"WS !" CR LF "Connection: close" CR LF CR LF

The string is a HTTP 0.9 request with nothing but a connection close
header. Any server actually processing it is encouraged to disconnect
via the unknown method, unknown URL, use of HTTP 0.9 and the
Connection close header. It costs 27 bytes.

In return for this overhead, any server which continues to process the
stream *should* consider this the last message on it. It relies on
these servers to support closing the connection after bad requests and
when requested, but surely at some stage we need to trust the server
to do something right.

Intermediatries supporting Upgrade should not be acting on the stream
after the 101 response. Servers implementing WebSockets know to ignore
it. I don't believe that it is a panacea, but it would add
encouragement to non-supporting servers to disconnect.

Regards,
Brodie